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Amendments to the Claims : 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

Listing of Claims: 

1 . (Currently Amended) A method of managing different types of events in a 
distributed computing system, having an event engine, including the steps of: 

i. providing one or more intelligent agents for receiving [[an]] a first 
event and converting the first event into a standard format, and 
inputting the first event into the engine; 

ii. the engine extracting a rule to be applied to the first event from a rules 
database wherein identification information within the rule identifies 
the first event; 

iii. the engine holding the first event for an expiration of a specified 
interval; 

iv. before the expiration of the specified interval, receiving at least one a 
further subsequent event from an intelligent agent, converting the 
furth e r subsequent event into a standard format and inputting the 
further subsequent into the engine; 

v. the engine identifying the furth e r subsequent event using identification 
information within the rule; 

vi. waiting for identical subsequent events: 

[[vi]] vii. if, during the specified interval, a predetermined number of 
identical subsequent events are received, the engine creating and 
outputting a new event with an attribute that indicates the number of 
identical subsequent events that were received : 

[[vii]] viii. inputting the new event into the engine ;-and 

[[viii]] ix. the engine extracting a second rule to be applied to the new 

event from a rules database wherein identification information within 
the second rule identifies the new event[[.]]; 

x. determining whether the number of identical subsequent events 
exceeds a threshold: 
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xi creating a threshold event indicating whether the number of identical 
subsequent events exceeds the threshold; and 

xii outputting the threshold event to a user. 

2. (Currently Amended) A method as claimed in claim 1 wherein the first event 
and the further subsequent event originate from any of a set of a network, an application or an 
operating system residing on the distributed computing system, and hardware. 

3. -4. (Cancelled) 

5. (Previously Presented) A method as claimed in claim 1, wherein the 
identification information includes: 

i. an attribute; 

ii. an operator; and 

iii. a value. 

6. (Original) A method as claimed in claim 5 wherein the specified interval is 

time. 

7. (Currently Amended) A method of managing different types of events in a 
distributed computing system, having an event engine, including the steps of: 

i. providing one or more intelligent agents configured for receiving [[an]] 
at least one event specifying a type of server failure and converting the 
event into a standard format, and inputting the event into the engine; 

ii. the engine extracting a rule to be applied to the event from a rules 
database wherein identification information within the rule identifies ^ 
the event; 

. iii. . Jhe engine creating and outputting a new event indicating a server . 

failure has occurred ; 

iv. inputting the new event into the engine; 

v. the engine extracting a second rule to be applied to the new event from 
the rules database wherein identification information within the second 
rule identifies the new event; 

vi. the engine holding the new event for the expiration of a specified 
interval; 
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vii. before the expiration of the specified interval, receiving a furth e r at 
least one subsequent event from an intelligent agent, converting the 
furth e r subsequent event into a standard format and inputting the 
furth e r subsequent event into the engine; 

viii. the engine identifying the subsequent event using identification 
information within the second rule; and 

ix. th e e ngin e cr e ating and outputting a furth e r n e w ev e nt wherein, if the 
subsequent event indicates a server restoration has occurred, outputting 
the subsequent event to a user, or if the subsequent event indicates a 
type of server failure, the subsequent event is discarded, and after the 
expiration of the specified interval the new event indicating a server 
failure has occurred is output to the user. 

8. (Currently Amended) A method as claimed in claim 7 wherein the event and 
the furth e r subsequent event originate from any of a set of a network, an application, an 
operating system, and hardware. 

9. -10. (Cancelled) 

1 1 . (Previously Presented) A method as claimed in claim 8, wherein the 
identification information includes: 

i. an attribute; 

ii. an operator; and 
iiL a value. 

12. (Original) A method as claimed in claim 1 1 wherein the specified interval is 

time. 

13. (Currently Amended) A method as claimed in claim 12 wherein the furth e r 
subsequent event is received by a user console. 

14. (Currently Amended) A method of managing different types of events in a 4 
distributed computing system using a management server, having an event engine, including 1 
the steps of: 
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i. providing one or more intelligent agents for receiving [[an]] at least 
one event related to the performance of a network and converting the 
event into a standard format, and inputting [[an]] the event into the 
engine; 

ii. the engine extracting a first rule to be applied to the event from a rules 
database wherein identification information within the first rule 
identifies the event; 

iii. the engine holding th e e v e nt for an e xpiration of a specified interval; 
creating and outputting a new event having an attribute set to the type 
of event related to the performance of the network received ; 

iv. inputting the new event into the engine: b e for e th e e xpiration of th e 
s p e cified int e rval, receiving a furth e r e v e nt from an int e lligent ag e nt, 
conv e rting th e furth e r ev e nt into a standard format and inputting th e 
furth e r e v e nt into the ev e nt engine; 

v. receiving at least one subsequent event indicating a portal service 
failure event from an intelligent agent, converting the subsequent event 
into a standard format and inputting the subsequent event into the 
engine; th e e ngine extracting a s e cond rul e , to b e appli e d to th e furth e r 
e v e nt from th e rul es databas e wher e in identification information within 
th e s e cond rul e id e ntifies th e further e v e nt; 

vi. the engine extracting a second rule to be applied to the subsequent 
event from a rules database wherein identification information within 
the second rule identifies the subsequent event: the engin e cr e ating and 
outputting a n e w e v e nt; 

vii. the engine holding the subsequent event for an expiration of a specified 
interval: b e for e th e e xpiration of the sp e cifi e d int e rval, inputting the 
n e w e v e nt into the e ngine; 

viii. before the expiration of the specified interval, receiving the new event : 
and the engine id e ntifying the now event using id e ntification 
information within th e fir s t rule; and 

ix. the engine creating and outputting a furth e r n e w an event identifying 
the cause of the portal service failure, having an attribute set to the 
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attribute of the new event that is set to the type of event related to the 
performance of the network . 

15. (Currently Amended) A method as claimed in claim 14 wherein the event and 
the furth e r new event originate from any of the set of a network, an application, an operating 
system, and hardware. 

16. -17. (Cancelled) 

18. (Previously Presented) A method as claimed in claim 15, wherein the 
identification information includes: 

i. an attribute; 

ii. an operator; and 

iii. a value. 

19. (Original) A method as claimed in claim 18 wherein the specified interval is 

time. 

20. (Currently Amended) A method a claimed in claim 19 wherein the furth e r 
new event is received by a user console. 

21 . (Currently Amended) A method of managing different types of events in a 
distributed computing system including the steps of: 

i. receiving [[an]] a first event indicating a database failure and 
converting the first event into a standard format; 

ii. extracting a rule to be applied to the first event from a rules database 
wherein identification information within the rule identifies the first 
event; 

iii. the engine holding the first event for an expiration of a specified 
interval; when sp e cifi e d within th e rule p e rforming one of: 

a) creating a n e w ev e nt; or 

b) holding th e e vent; 

wh e r e in during th e method at l e ast on e rul e sp e cifi e s 
p e rformanc e of st e p (a) and at l e ast on e rule specifies 
performanc e of st e p (b); and 
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iv. if a subsequent event indicating the database is restored is received 
before expiration of the specified interval, discarding the first event 
and the subsequent event; and repeating stops (i) to (in) at lea s t onco; 
wher e in at least one received e v e nt in st e p (i) is a new e vent created in 
st e p (iii) (a). 

v. if the subsequent event indicating the database is restored is not 
received before expiration of the specified interval, outputting the first 
event indicating database failure to a user. 

22. (Cancelled) 

23. (Currently Amended) A method of managing different types of events in a 
distributed computing system including the steps of: 

i. processing [[an]] a first event by: 

iL [[a)]] receiving the first event and converting the first event into 

standard format; 

iii. [[b)]] extracting one or more rules which match the event from a rules 

database; 

e) discarding th e e vent if at l e ast on e of th e rul e s sp e cifi e s that the e v e nt 

is to b e discard e d; 

iv. [[d)]] holding the first event if at l e ast on e of th e rul e s sp e cifi e s that 

th e ev e nt is to b e held for a specified period of time; 

v. [[e)]] receiving at least one subsequent event within the specified 

period of time: alt e ring the event or cr e ating a now ev e nt if at l e a s t one 
of th e rul e s sp e cifi e s that th e e v e nt is to be alt e red or a n e w e v e nt 
cr e at e d; and 

vL [[f)]] if the subsequent event is the same type of event as the first 

event, discarding the subsequent event; outputting th e ovont if all rulos 
sp e cify that th e e v e nt is to b e outputt e d; 

wh e r e in if th e e v e nt is discard e d th e n n e ith e r of steps (d) and ( e ) will 
proce e d; 

vii. [[ii.]] at the end of the specified period of time, creating a new event 
that indicates the number of subsequent events that were discarded 
during the specified period of time; and holding th e e v e nt for th e 
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longest p e riod of tim e specified by the rules if th e e v e nt is sp e cifi e d to 
b e h e ld; and 

viii. [[iii.]] outputting the first event and the new event to a user, r e p e ating 
st e p (i) if th e e vent was held in step (ii). 

24. (Currently Amended) A computer implemented system for managing different 
types of events in a distributed computing system , embodied in a computer readable medium, 
including: 

i. computer code for providing a plurality of event agents adapted to 
receive data from a source, to create an event from the data, convert the 
event into a standard format and to transmit the event to a central event 
system; and 

ii. computer code for providing a central event system including: 

a) a rules database adapted to store a plurality of rules, each rule 
including: 

I. identification information specifying to which events 
the rule relates; and 

II. an action for filtering, correlating or consolidating one 
or more received events wherein the action is one of 
outputting the event, discarding the event, holding the 
event, or creating a new event; 

wherein, where the action is holding the event the rule further 
includes: 

I. a condition; and 

II. a further action wherein the further action is one of 
outputting the event, discarding the event, holding the 
event, creating a new event, or creating a new event and 
transmitting the new event back into the processing 
engine; and 

b) a processing engine adapted to receive events, to extract rules 
from the rules database, to identify which rules apply to the 
events using the identification information within the rule, to 
perform the action specified within the applicable rules, and to 
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perform the further action specified within the applicable rules 
when the corresponding condition is satisfied. 



25. (Currently Amended) A computer implemented system as claimed in claim 24 
including one or more user consoles adapted to receive one or more of the events outputted by 
the central event system. 

26. (Currently Amended) A computer implemented system as claimed in claim 25 
wherein the source is any one of a set of a database, an application, an operating system, and 
hardware. 

27. (Currently Amended) A computer implemented system as claimed in claim 26 
wherein the identification information includes: 



l. 



an attribute; 



n. 



an operator; and 



in. 



a value. 



28.-29. 



(Cancelled) 



30. 



(Previously Presented) Storage media containing software for executing the 



method of claim 21. 



31.-32. 



(Cancelled) 
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